<div dir="ltr"><div><div class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><a href="https://www.itproportal.com/features/bigger-than-ransomware-cryptojacking-is-the-new-money-maker/">https://www.itproportal.com/features/bigger-than-ransomware-cryptojacking-is-the-new-money-maker/</a></div><div dir="ltr"><br></div><div dir="ltr"><p style="margin:0px 0px 1em;padding:0px;border:0px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-weight:400;font-stretch:inherit;line-height:1.5;font-family:"Open Sans",Arial,sans-serif;font-size:16px;vertical-align:baseline;width:602px;color:rgb(51,51,51);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">Cybercrime is an extremely lucrative business: a flourishing economy generating a staggering $1.5 trillion in revenues every year,<span> </span><a href="https://venturebeat.com/2018/04/21/the-web-of-profit-a-look-at-the-cybercrime-economy/" rel="nofollow" target="_blank" style="margin:0px;padding:0px;border:0px;font-style:inherit;font-variant:inherit;font-weight:inherit;font-stretch:inherit;line-height:inherit;font-family:inherit;font-size:16px;vertical-align:baseline;color:rgb(143,198,223);text-decoration:none">according to a recent estimate</a>. Perfect for cybercriminals, as this is maximum ROI for minimum effort and practically little risk of penalty.</p><p style="margin:0px 0px 1em;padding:0px;border:0px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-weight:400;font-stretch:inherit;line-height:1.5;font-family:"Open Sans",Arial,sans-serif;font-size:16px;vertical-align:baseline;width:602px;color:rgb(51,51,51);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">In this scenario it comes as no surprise that cryptojacking, the unauthorized use of someone else’s computing resources to mine cryptocurrency, has replaced ransomware as the number one threat for consumers and enterprises.</p><p style="margin:0px 0px 1em;padding:0px;border:0px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-weight:400;font-stretch:inherit;line-height:1.5;font-family:"Open Sans",Arial,sans-serif;font-size:16px;vertical-align:baseline;width:602px;color:rgb(51,51,51);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">The fluctuations of the Bitcoin value, a problem for the business model of ransomware that relies on quick and repeated attacks characterized by small payments, along with the research of new attack techniques able to provide a better pay-out ratio, have rapidly pushed cryptojacking to the top of the infosecurity issues in 2018. </p><p style="margin:0px 0px 1em;padding:0px;border:0px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-weight:400;font-stretch:inherit;line-height:1.5;font-family:"Open Sans",Arial,sans-serif;font-size:16px;vertical-align:baseline;width:602px;color:rgb(51,51,51);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">Let’s look more in detail at the factors that have driven this shift.   </p><h3 id="gmail-higher-pay-out-ratio-xa0" style="margin:0px 0px 1em;padding:0px;border:0px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-weight:700;font-stretch:inherit;line-height:30px;font-family:"Open Sans",Arial,sans-serif;font-size:24px;vertical-align:baseline;width:602px;background:rgb(255,255,255);color:rgb(51,51,51);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration-style:initial;text-decoration-color:initial">Higher Pay-Out Ratio </h3><p style="margin:0px 0px 1em;padding:0px;border:0px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-weight:400;font-stretch:inherit;line-height:1.5;font-family:"Open Sans",Arial,sans-serif;font-size:16px;vertical-align:baseline;width:602px;color:rgb(51,51,51);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">United they mine… With a cryptocurrency market cap of nearly<span> </span><a href="https://coinmarketcap.com/charts/" rel="nofollow" target="_blank" style="margin:0px;padding:0px;border:0px;font-style:inherit;font-variant:inherit;font-weight:inherit;font-stretch:inherit;line-height:inherit;font-family:inherit;font-size:16px;vertical-align:baseline;color:rgb(143,198,223);text-decoration:none">$500 billion</a>, cryptojacking is extremely attractive for cybercriminals: it does not require high technical skills and, unlike ransomware, offers a potential 100% pay-out ratio. Once compromised, the infected machine can start immediately to mine cryptocurrency in in stealth mode regardless of its processing power or geographical location: even low-end systems are useful to the cause since it’s the size of the network of compromised machines, and hence the total computational power, that really matters. Additionally, if the attackers don’t get carried away and tune the miner not to completely drain the CPU (up to the point of<span> </span><a href="https://www.darkreading.com/mobile/new-android-cryptojacker-can-brick-phones/d/d-id/1331398" rel="nofollow" target="_blank" style="margin:0px;padding:0px;border:0px;font-style:inherit;font-variant:inherit;font-weight:inherit;font-stretch:inherit;line-height:inherit;font-family:inherit;font-size:16px;vertical-align:baseline;color:rgb(143,198,223);text-decoration:none">bricking your Android device</a>), the attack can go on stealth and undetected for a long time. </p><h3 id="gmail-ubiquity-of-the-attack-surface-xa0" style="margin:0px 0px 1em;padding:0px;border:0px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-weight:700;font-stretch:inherit;line-height:30px;font-family:"Open Sans",Arial,sans-serif;font-size:24px;vertical-align:baseline;width:602px;background:rgb(255,255,255);color:rgb(51,51,51);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration-style:initial;text-decoration-color:initial">Ubiquity of the Attack Surface </h3><p style="margin:0px 0px 1em;padding:0px;border:0px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-weight:400;font-stretch:inherit;line-height:1.5;font-family:"Open Sans",Arial,sans-serif;font-size:16px;vertical-align:baseline;width:602px;color:rgb(51,51,51);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">One rig to mine them all... Ubiquity of the attack surface is another important aspect. Whatever you are, wherever you are… You can mine… It doesn’t matter if the malicious miner component is injected into a mobile device, a personal computer, a server, an instance in the cloud, or even an IoT device, like a camera, a fridge, a fan. It doesn’t even matter what operating system is being used. With any OS, the attackers can take advantage of its CPU cycles for their illegitimate purposes. Even IoT devices with limited processing power can be recruited: the Mirai botnet has taught us what multiple IoT devices can do when<span> </span><a href="https://thenextweb.com/security/2016/10/21/massive-ddos-attack-dyn-dns-causing-havoc-online/" rel="nofollow" target="_blank" style="margin:0px;padding:0px;border:0px;font-style:inherit;font-variant:inherit;font-weight:inherit;font-stretch:inherit;line-height:inherit;font-family:inherit;font-size:16px;vertical-align:baseline;color:rgb(143,198,223);text-decoration:none">working together</a>, thousands at a time. And it’s not a coincidence that a variant has been<span> </span><a href="https://internetofbusiness.com/mirai-malware-bitcoins-iot-devices/" rel="nofollow" target="_blank" style="margin:0px;padding:0px;border:0px;font-style:inherit;font-variant:inherit;font-weight:inherit;font-stretch:inherit;line-height:inherit;font-family:inherit;font-size:16px;vertical-align:baseline;color:rgb(143,198,223);text-decoration:none">repurposed</a><span> </span>to mine cryptocurrency, and the same botnet has also spawned Satori, a variant infecting mining rigs, hijacking the device owner's mining credentials. In fact, hacking multiple IoT devices can be rewarding: according to a recent estimate, 15,000 hacked internet-connected gadgets can mine $1,000 of cryptocurrency in just four days. Not bad considering that by 2020, there will be over<span> </span><a href="https://www.gartner.com/newsroom/id/3598917" rel="nofollow" target="_blank" style="margin:0px;padding:0px;border:0px;font-style:inherit;font-variant:inherit;font-weight:inherit;font-stretch:inherit;line-height:inherit;font-family:inherit;font-size:16px;vertical-align:baseline;color:rgb(143,198,223);text-decoration:none">20 billion</a><span> </span>internet-connected devices. </p><h3 id="gmail-multiple-infection-mechanisms-xa0" style="margin:0px 0px 1em;padding:0px;border:0px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-weight:700;font-stretch:inherit;line-height:30px;font-family:"Open Sans",Arial,sans-serif;font-size:24px;vertical-align:baseline;width:602px;background:rgb(255,255,255);color:rgb(51,51,51);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration-style:initial;text-decoration-color:initial">Multiple Infection Mechanisms </h3><p style="margin:0px 0px 1em;padding:0px;border:0px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-weight:400;font-stretch:inherit;line-height:1.5;font-family:"Open Sans",Arial,sans-serif;font-size:16px;vertical-align:baseline;width:602px;color:rgb(51,51,51);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">All roads lead to a mine… The high pay-out ratio and the ubiquity of the attack surface aren’t the only advantages of cryptojacking. Since malicious miners can be injected in virtually any device, multiple infection vectors can be utilized accordingly: brute-force attacks, unpatched vulnerabilities, or compromised websites (drive-by cryptomining) are just few examples of the techniques showcased so far. Have a look at the<a href="https://www.hackmageddon.com/2018-master-table/" rel="nofollow" target="_blank" style="margin:0px;padding:0px;border:0px;font-style:inherit;font-variant:inherit;font-weight:inherit;font-stretch:inherit;line-height:inherit;font-family:inherit;font-size:16px;vertical-align:baseline;color:rgb(143,198,223);text-decoration:none"><span> </span>timelines</a><span> </span>of cyberattacks that I collect on a monthly basis, and you will be surprised by the creativity of the attackers in continuously finding new ways to perpetrate cryptojacking attacks. </p><p style="margin:0px 0px 1em;padding:0px;border:0px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-weight:400;font-stretch:inherit;line-height:1.5;font-family:"Open Sans",Arial,sans-serif;font-size:16px;vertical-align:baseline;width:602px;color:rgb(51,51,51);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">Servers have been compromised in multiple ways to inject miners: from old-school brute-force attacks with default credentials (the case of a recent campaign targeting thousands of Magento sites), to the exploitation of unpatched vulnerabilities such as, just to name a few, Oracle WebLogic (CVE 2017-10271), Apache Struts (CVE-2017-5638), DotNetNuke (CVE-2017-9822), OrientDB (CVE-2017-11467), Jenkins CI (CVE-2017-1000353), JBoss servers (CVE-2017-12149), and Apache Solr (CVE-2017-12629).</p><p style="margin:0px 0px 1em;padding:0px;border:0px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-weight:400;font-stretch:inherit;line-height:1.5;font-family:"Open Sans",Arial,sans-serif;font-size:16px;vertical-align:baseline;width:602px;color:rgb(51,51,51);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">Unpatched vulnerabilities have also been used to compromise clients, making new slaves for the cryptominer botnets. The Smomirnu botnet and Wannamine malware are two examples of threats exploiting the infamous EternalBlue vulnerability (CVE-2017-144) to spread. Even existing malware can be<span> </span><a href="https://www.zdnet.com/article/this-ransomware-was-rewritten-to-mine-cryptocurrency-and-destroy-your-files/" rel="nofollow" target="_blank" style="margin:0px;padding:0px;border:0px;font-style:inherit;font-variant:inherit;font-weight:inherit;font-stretch:inherit;line-height:inherit;font-family:inherit;font-size:16px;vertical-align:baseline;color:rgb(143,198,223);text-decoration:none">rewritten</a>to mine cryptocurrency, or to add this “feature” to the existing ones. </p><p style="margin:0px 0px 1em;padding:0px;border:0px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-weight:400;font-stretch:inherit;line-height:1.5;font-family:"Open Sans",Arial,sans-serif;font-size:16px;vertical-align:baseline;width:602px;color:rgb(51,51,51);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">In reality clients are even more exposed since they can mine cryptocurrency simply visiting a web-page hosting a JavaScript miner like Coinhive. Coinhive mines a cryptocurrency called Monero (XMR) and the main reason is that, besides being able to stay anonymous with this blockchain, the algorithm used to calculate the hashes, called Cryptonight,<span> </span><a href="https://coinhive.com/#hash-rate" rel="nofollow" target="_blank" style="margin:0px;padding:0px;border:0px;font-style:inherit;font-variant:inherit;font-weight:inherit;font-stretch:inherit;line-height:inherit;font-family:inherit;font-size:16px;vertical-align:baseline;color:rgb(143,198,223);text-decoration:none">was designed to run well on consumer CPUs</a><span> </span>(what a coincidence!). An opportunity too tempting (and easy) not to be exploited by criminals, who are now constantly scanning websites for vulnerabilities that allow them to inject Coinhive: the<span> </span><a href="https://www.techrepublic.com/article/l-a-times-website-injected-with-monero-cryptocurrency-mining-script/" rel="nofollow" target="_blank" style="margin:0px;padding:0px;border:0px;font-style:inherit;font-variant:inherit;font-weight:inherit;font-stretch:inherit;line-height:inherit;font-family:inherit;font-size:16px;vertical-align:baseline;color:rgb(143,198,223);text-decoration:none">Los Angeles Times</a>, and<span> </span><a href="https://www.infosecurity-magazine.com/news/monero-cryptomining-invades/" rel="nofollow" target="_blank" style="margin:0px;padding:0px;border:0px;font-style:inherit;font-variant:inherit;font-weight:inherit;font-stretch:inherit;line-height:inherit;font-family:inherit;font-size:16px;vertical-align:baseline;color:rgb(143,198,223);text-decoration:none">Blackberry Mobile</a><span> </span>are two noticeable examples of high-profile websites compromised for this purpose in 2018. Not to mention the fact the discretional opt-in controls available with Coinhive that were never respected in such cases. </p><p style="margin:0px 0px 1em;padding:0px;border:0px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-weight:400;font-stretch:inherit;line-height:1.5;font-family:"Open Sans",Arial,sans-serif;font-size:16px;vertical-align:baseline;width:602px;color:rgb(51,51,51);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">But this is only the tip of the iceberg, since drive-by cryptomining campaigns are becoming bigger, more prevalent and more persistent while you browse the internet. Criminals are now adopting a modus operandi similar to malvertising (minevertising), injecting the Coinhive code into advertisements supplied by platforms like AOL or Google DoubleClick (two examples occurred in 2018). It doesn’t even matter if the user leaves the compromised page or closes his browser (or at least he believes to) since the malicious code can be hidden into a tiny ‘pop-under’ window hidden behind the Windows taskbar, making it persistent and invisible to the user. There have also been cases of malicious browser extensions injecting Coinhive directly into the browser. </p><h3 id="gmail-the-role-of-the-cloud-xa0" style="margin:0px 0px 1em;padding:0px;border:0px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-weight:700;font-stretch:inherit;line-height:30px;font-family:"Open Sans",Arial,sans-serif;font-size:24px;vertical-align:baseline;width:602px;background:rgb(255,255,255);color:rgb(51,51,51);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration-style:initial;text-decoration-color:initial">The Role of the Cloud </h3><p style="margin:0px 0px 1em;padding:0px;border:0px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-weight:400;font-stretch:inherit;line-height:1.5;font-family:"Open Sans",Arial,sans-serif;font-size:16px;vertical-align:baseline;width:602px;color:rgb(51,51,51);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">The sun always mines above the cloud… The<span> </span><a href="https://www.infosecurity-magazine.com/news/rsac-the-five-most-dangerous/" rel="nofollow" target="_blank" style="margin:0px;padding:0px;border:0px;font-style:inherit;font-variant:inherit;font-weight:inherit;font-stretch:inherit;line-height:inherit;font-family:inherit;font-size:16px;vertical-align:baseline;color:rgb(143,198,223);text-decoration:none">list</a><span> </span>of the five most new dangerous attacks presented by the SANS institute at the last RSA Conference includes both cloud storage data leakage and monetization of compromised systems via cryptominers. Data leakage in the cloud is often the consequence of misconfigurations like wrong permissions or lack of an adequate password protection. Besides stealing data, the same misconfigurations can be used by crooks to spin-up their own instances and use them to mine cryptocurrency at the expense of the victim, with the concrete possibility that the latter will not detect the attack until the next bill. A deadly combination of the two attack techniques listed by the SANS Institute has already hit some high-profile victims like Tesla, whose public cloud was used to mine cryptocurrency. </p><p style="margin:0px 0px 1em;padding:0px;border:0px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-weight:400;font-stretch:inherit;line-height:1.5;font-family:"Open Sans",Arial,sans-serif;font-size:16px;vertical-align:baseline;width:602px;color:rgb(51,51,51);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">There are also some additional risks. Miners can use known cloud services to spread more quickly inside organizations (Netskope Threat Research Labs discovered<span> </span><a href="https://www.netskope.com/blog/modern-gold-mine-rush-office-365-as-a-crypto-miners-paradise/" rel="nofollow" target="_blank" style="margin:0px;padding:0px;border:0px;font-style:inherit;font-variant:inherit;font-weight:inherit;font-stretch:inherit;line-height:inherit;font-family:inherit;font-size:16px;vertical-align:baseline;color:rgb(143,198,223);text-decoration:none">a Coinhive miner resident in a Microsoft Office 365 OneDrive for Business instance</a>), or also to evade detection (like in case of<span> </span><a href="https://www.netskope.com/blog/coin-mining-malware-heads-cloud-zminer/" rel="nofollow" target="_blank" style="margin:0px;padding:0px;border:0px;font-style:inherit;font-variant:inherit;font-weight:inherit;font-stretch:inherit;line-height:inherit;font-family:inherit;font-size:16px;vertical-align:baseline;color:rgb(143,198,223);text-decoration:none">Zminer</a><span> </span>that downloads payloads from Amazon S3 cloud storage).   </p><h3 id="gmail-general-recommendations-xa0" style="margin:0px 0px 1em;padding:0px;border:0px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-weight:700;font-stretch:inherit;line-height:30px;font-family:"Open Sans",Arial,sans-serif;font-size:24px;vertical-align:baseline;width:602px;background:rgb(255,255,255);color:rgb(51,51,51);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration-style:initial;text-decoration-color:initial">General Recommendations </h3><p style="margin:0px 0px 1em;padding:0px;border:0px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-weight:400;font-stretch:inherit;line-height:1.5;font-family:"Open Sans",Arial,sans-serif;font-size:16px;vertical-align:baseline;width:602px;color:rgb(51,51,51);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">There are few steps that can be done in order to mitigate the rising threat of cryptojacking. </p><p style="margin:0px 0px 1em;padding:0px;border:0px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-weight:400;font-stretch:inherit;line-height:1.5;font-family:"Open Sans",Arial,sans-serif;font-size:16px;vertical-align:baseline;width:602px;color:rgb(51,51,51);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">1. Govern web use with a<span> </span><a href="https://www.netskope.com/platform/netskope-for-web/" rel="nofollow" target="_blank" style="margin:0px;padding:0px;border:0px;font-style:inherit;font-variant:inherit;font-weight:inherit;font-stretch:inherit;line-height:inherit;font-family:inherit;font-size:16px;vertical-align:baseline;color:rgb(143,198,223);text-decoration:none">multi-layered threat protection platform</a><span> </span>like Netskope for Web, able to unify SaaS, IaaS, and web security from a single pane of glass. </p><p style="margin:0px 0px 1em;padding:0px;border:0px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-weight:400;font-stretch:inherit;line-height:1.5;font-family:"Open Sans",Arial,sans-serif;font-size:16px;vertical-align:baseline;width:602px;color:rgb(51,51,51);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">2. Detect and remediate cryptominers in the cloud, using a threat-aware<span> </span><a href="https://www.netskope.com/company/about-casb/" rel="nofollow" target="_blank" style="margin:0px;padding:0px;border:0px;font-style:inherit;font-variant:inherit;font-weight:inherit;font-stretch:inherit;line-height:inherit;font-family:inherit;font-size:16px;vertical-align:baseline;color:rgb(143,198,223);text-decoration:none">CASB solution</a><span> </span>like Netskope: enforce policy on usage of unsanctioned services, as well as unsanctioned instances of sanctioned cloud services to block hybrid multi stage attacks where the payload is downloaded from a cloud service. </p><p style="margin:0px 0px 1em;padding:0px;border:0px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-weight:400;font-stretch:inherit;line-height:1.5;font-family:"Open Sans",Arial,sans-serif;font-size:16px;vertical-align:baseline;width:602px;color:rgb(51,51,51);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">3. Sample policies to enforce:   </p><ul style="margin:0px 0px 1em;padding:0px;border:0px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-weight:400;font-stretch:inherit;line-height:inherit;font-family:"Open Sans",Arial,sans-serif;font-size:16px;vertical-align:baseline;list-style:none;color:rgb(51,51,51);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial"><li style="margin:0px;padding:0px;border:0px;font-style:inherit;font-variant:inherit;font-weight:inherit;font-stretch:inherit;line-height:1.5;font-family:inherit;font-size:16px;vertical-align:baseline;list-style:disc inside none">Scan all uploads from unmanaged devices to sanctioned cloud applications for malware  </li><li style="margin:0px;padding:0px;border:0px;font-style:inherit;font-variant:inherit;font-weight:inherit;font-stretch:inherit;line-height:1.5;font-family:inherit;font-size:16px;vertical-align:baseline;list-style:disc inside none">Scan all uploads from remote devices to sanctioned cloud applications for malware  Scan all downloads from unsanctioned cloud applications for malware  </li><li style="margin:0px;padding:0px;border:0px;font-style:inherit;font-variant:inherit;font-weight:inherit;font-stretch:inherit;line-height:1.5;font-family:inherit;font-size:16px;vertical-align:baseline;list-style:disc inside none">Scan all downloads from unsanctioned instances of sanctioned cloud applications for malware  Enforce quarantine/block actions on malware detection to reduce user impact  </li><li style="margin:0px;padding:0px;border:0px;font-style:inherit;font-variant:inherit;font-weight:inherit;font-stretch:inherit;line-height:1.5;font-family:inherit;font-size:16px;vertical-align:baseline;list-style:disc inside none">Block unsanctioned instances of sanctioned/well known cloud apps, to prevent attackers from exploiting user trust in cloud. While this seems a little restrictive, it significantly reduces the risk of malware infiltration attempts via cloud </li></ul><p style="margin:0px 0px 1em;padding:0px;border:0px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-weight:400;font-stretch:inherit;line-height:1.5;font-family:"Open Sans",Arial,sans-serif;font-size:16px;vertical-align:baseline;width:602px;color:rgb(51,51,51);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">4. Deploy a CASB solution able to perform<span> </span><a href="https://www.netskope.com/press-releases/netskope-expands-market-leading-iaas-security-capabilities-continuous-security-assessment-monitoring-capabilities/" rel="nofollow" target="_blank" style="margin:0px;padding:0px;border:0px;font-style:inherit;font-variant:inherit;font-weight:inherit;font-stretch:inherit;line-height:inherit;font-family:inherit;font-size:16px;vertical-align:baseline;color:rgb(143,198,223);text-decoration:none">continuous security assessment</a><span> </span>and monitoring of your IaaS & PaaS configuration. This includes infrastructure misconfigurations and vulnerabilities that can lead to potential compromise and subsequent installation of cryptominers, or setup of malicious instances aimed to mine cryptocurrency. </p><p style="margin:0px 0px 1em;padding:0px;border:0px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-weight:400;font-stretch:inherit;line-height:1.5;font-family:"Open Sans",Arial,sans-serif;font-size:16px;vertical-align:baseline;width:602px;color:rgb(51,51,51);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">5. Obviously, make sure that an effective patch management process for clients and servers are in place. Ensure that the corporate antivirus is updated with the latest releases and patches. </p><p style="margin:0px 0px 1em;padding:0px;border:0px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-weight:400;font-stretch:inherit;line-height:1.5;font-family:"Open Sans",Arial,sans-serif;font-size:16px;vertical-align:baseline;width:602px;color:rgb(51,51,51);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">6. Encourage a responsible usage of the company resources: </p><ul style="margin:0px 0px 1em;padding:0px;border:0px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-weight:400;font-stretch:inherit;line-height:inherit;font-family:"Open Sans",Arial,sans-serif;font-size:16px;vertical-align:baseline;list-style:none;color:rgb(51,51,51);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial"><li style="margin:0px;padding:0px;border:0px;font-style:inherit;font-variant:inherit;font-weight:inherit;font-stretch:inherit;line-height:1.5;font-family:inherit;font-size:16px;vertical-align:baseline;list-style:disc inside none">Warn users to avoid executing unsigned macros and macros from an untrusted source, unless they are very sure that they are benign  </li><li style="margin:0px;padding:0px;border:0px;font-style:inherit;font-variant:inherit;font-weight:inherit;font-stretch:inherit;line-height:1.5;font-family:inherit;font-size:16px;vertical-align:baseline;list-style:disc inside none">Warn users to avoid executing any file unless they are very sure that they are benign  </li><li style="margin:0px;padding:0px;border:0px;font-style:inherit;font-variant:inherit;font-weight:inherit;font-stretch:inherit;line-height:1.5;font-family:inherit;font-size:16px;vertical-align:baseline;list-style:disc inside none">Warn users against opening untrusted attachments, regardless of their extensions or filenames </li></ul><p style="margin:0px 0px 1em;padding:0px;border:0px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-weight:400;font-stretch:inherit;line-height:1.5;font-family:"Open Sans",Arial,sans-serif;font-size:16px;vertical-align:baseline;width:602px;color:rgb(51,51,51);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">7. Ad-blockers or browser extensions like<span> </span><a href="https://noscript.net/" rel="nofollow" target="_blank" style="margin:0px;padding:0px;border:0px;font-style:inherit;font-variant:inherit;font-weight:inherit;font-stretch:inherit;line-height:inherit;font-family:inherit;font-size:16px;vertical-align:baseline;color:rgb(143,198,223);text-decoration:underline">NoScript</a><span> </span>can help to prevent drive-by cryptomining attacks. Recently some specific browser extensions have been published, which can block JavaScript miners like CoinHive, however be careful to install only trusted ones, since rogue browser extensions are also a common mechanism to inject cryptominers directly into the browser.  </p><p style="margin:0px 0px 1em;padding:0px;border:0px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-weight:400;font-stretch:inherit;line-height:1.5;font-family:"Open Sans",Arial,sans-serif;font-size:16px;vertical-align:baseline;width:602px;color:rgb(51,51,51);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">8. Administrators can create firewall rules to block bitcoin pools documented in the Wikipedia article. </p><br><br clear="all"><div><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><b><span style="font-size:10pt"></span></b><span style="font-size:10pt"></span><span style="font-family:arial,helvetica,sans-serif"></span><br></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>
</div>